Self-service terminal and method for providing security at a self-service terminal

ABSTRACT

A self-service terminal and a method for providing security at a self-service terminal are disclosed, wherein the self-service terminal comprises: an imaging device, configured for providing at least one digital image; at least one processor, configured for applying a facial recognition method to the at least one digital image; and for controlling the self-service terminal using a facial recognition criterion depending on the result of the facial recognition method.

BACKGROUND

Various exemplary embodiments relate to a self-service terminal and to amethod for providing security at a self-service terminal.

At a self-service terminal, such as an automated teller machine, forexample, a user can take advantage of various services withoutinteraction with an additional person. Security violations can occurhere during the use of the self-service terminal. By way of example, atan automated teller machine a disguised/masked person may withdraw moneyusing a stolen bank card, or an additional person may covertly observethe PIN (personal identification number) entered by a user, or, afterthe PIN has been entered, an additional person may push the user out ofthe way or overpower the user and steal/purloin the money from thedispensing tray, or the user may forget the money in the dispensing trayand/or may forget the bank card and an additional person may take themoney from the dispensing tray and/or the bank card (for example, theadditional person may deliberately wait for a user to forget moneyand/or a bank card). Therefore, it may be necessary to provide securityat a self-service terminal, for example to ensure security for a userduring the use of the self-service terminal.

SUMMARY

In accordance with various embodiments, a self-service terminal and amethod for providing security at a self-service terminal are providedwhich are able to provide security at a self-service terminal, i.e.which are able to prevent harmful behavior at a self-service terminal.

In accordance with various embodiments, a self-service terminalcomprises: an imaging device, configured for providing at least onedigital image; at least one processor, configured for applying a facialrecognition method to the at least one digital image; and forcontrolling the self-service terminal using a facial recognitioncriterion depending on the result of the facial recognition method.

The self-service terminal having the features of independent claim 1forms a first example.

The imaging device can comprise one or more imaging sensors, wherein theone or more imaging sensors can optionally comprise a camera sensorand/or a video camera sensor. The features described in this paragraphin combination with the first example form a second example.

The facial recognition method can comprise determining whether the atleast one digital image comprises a face of a first person. The facialrecognition method can furthermore comprise extracting biometricfeatures of the face if the at least one digital image comprises theface of the first person. The features described in this paragraph incombination with the first example or the second example form a thirdexample.

The facial recognition criterion can be dependent on whether a face wasrecognized or was not recognized. The facial recognition criterion canbe dependent on the biometric features of the face. To put it anotherway, the facial recognition criterion can comprise whether a face wasrecognized in the at least one digital image or whether no face wasrecognized and, if a face was recognized, the facial criterion can bedependent on the extracted biometric features, for example the number ofextracted biometric features or whether predefined biometric featurescould not be extracted. The features described in this paragraph incombination with one or more of the first example to the third exampleform a fourth example.

The facial recognition criterion can comprise, if the at least onedigital image comprises a face of the first person, whether the face ishidden. The feature described in this paragraph in combination with thethird example or the fourth example forms a fifth example.

The face can be hidden if at least one biometric feature of thebiometric features does not satisfy a feature criterion. Illustratively,for example, a biometric feature of the mouth region of the face cannotbe extracted and the at least one processor can determine that the faceis hidden, for example masked, in this case. The feature described inthis paragraph in combination with the fifth example forms a sixthexample.

The at least one processor can be configured for controlling theself-service terminal in such a way that the self-service terminal isactivated from a standby state if the face is not hidden. That has theeffect that the self-service terminal is activated only if a non-maskedor non-disguised person would like to operate or use the self-serviceterminal. The feature described in this paragraph in combination withthe fifth example or the sixth example forms a seventh example.

The at least one processor can be configured for controlling theself-service terminal in such a way that the self-service terminalmaintains a standby state if the face is hidden. That has the effectthat the self-service terminal cannot be used or operated by a disguisedor masked person, such as a thief, for example. The self-serviceterminal can optionally furthermore comprise a display device, which canbe configured to provide the person assigned to the face withinformation that the face is hidden. The features described in thisparagraph in combination with one or more of the fifth example to theseventh example form an eighth example.

The facial recognition method can determine that the at least onedigital image comprises a first face of a first person and furthermore asecond face of a second person, and the processor can be configured forcontrolling the self-service terminal using a first criterion and asecond criterion depending on the result of the facial recognitionmethod, wherein the first criterion can be assigned to the first personand wherein the second criterion can be assigned to the second person.The at least one processor can be configured to determine firstbiometric features assigned to the first face of the first person and/orsecond biometric features assigned to the second face of the secondperson. That has the effect that a disguised or masked person in thevicinity of the user is recognized and the self-service terminal cantransition for example to a security state, by way of example,dispensing of money at an automated teller machine can be stopped orblocked in this case. The features described in this paragraph incombination with one or more of the first example to the eighth exampleform a ninth example.

The self-service terminal can furthermore comprise a user interface. Theuser interface can comprise a display device, which can be configured toprovide to the first person the at least one digital image showing thefirst face of the first person and the second face of the second person.That has the effect that a user of a self-service terminal can beadvised of a potential threat or a potential security violation. Thefeatures described in this paragraph in combination with the ninthexample form a tenth example.

The at least one processor can furthermore be configured for determininga first distance between the first person and the self-service terminal.The at least one processor can furthermore be configured for determininga second distance between the second person and the self-serviceterminal. The display device can be configured for providing distanceinformation to the first person using the first distance of the firstperson and the second distance of the second person. That has theeffect, for example, that the user can be advised that a personal spacedistance is not being complied with. The features described in thisparagraph in combination with the ninth example or the tenth exampleform an eleventh example.

The at least one processor can be configured to determine the firstdistance of the first person using the at least one digital image. Theat least one processor can be configured to determine the first distanceusing a first interocular distance of the first person. The at least oneprocessor can be configured to determine the first interocular distanceusing the extracted first biometric data. The at least one processor canbe configured to determine the second distance of the second personusing the at least one digital image. The at least one processor can beconfigured to determine the second distance using a second interoculardistance of the second person. The at least one processor can beconfigured to determine the second interocular distance using theextracted second biometric data. The features described in thisparagraph in combination with the eleventh example form a twelfthexample.

The self-service terminal can comprise at least one distance sensorconfigured for detecting at least one distance of a person, wherein theat least one processor determines the first distance of the first personand/or the second distance of the second person using the detecteddistance. The features described in this paragraph in combination withthe eleventh example form a thirteenth example.

The imaging device can be configured to provide a first digital imageand a second digital image, wherein the second digital image temporallyfollows the first digital image. The facial recognition method candetermine that the first digital image comprises a first face of a firstperson and that the second digital image does not comprise the firstface of the first person, and the at least one processor can beconfigured for controlling the self-service terminal in such a way thatthe self-service terminal transitions to a security state. That has theeffect, for example, that, if a user forgets to take the money from thedispensing tray of an automated teller machine, the dispensing tray canbe closed in the security state. That furthermore has the effect that,if a user at the self-service terminal is overpowered and/or pushed outof the way, the attacker cannot operate the self-service terminal in thesecurity state. The features described in this paragraph in combinationwith one or more of the first example to the thirteenth example form afourteenth example.

The self-service terminal can furthermore comprise a storage deviceconfigured to store the at least one digital image. The featuredescribed in this paragraph in combination with one or more of the firstexample to the fourteenth example forms a fifteenth example.

The storage device can comprise a volatile memory for storing the atleast one digital image. The feature described in this paragraph incombination with the fifteenth example forms a sixteenth example.

The storage device can furthermore be configured to erase the at leastone digital image after a termination criterion has been satisfied. Ifbiometric features for a face of a person were extracted, the storagedevice can furthermore be configured to erase the extracted biometricfeatures after the termination criterion has been satisfied. That hasthe effect that the personal data of a user are not stored permanently,but rather only during the operation of the self-service terminal, andthe anonymity of the user is thus ensured. The features described inthis paragraph in combination with the fifteenth example or thesixteenth example form a seventeenth example.

The self-service terminal can be an automated teller machine, aself-service checkout or a self-service kiosk. The features described inthis paragraph in combination with one or more of the first example tothe seventeenth example form an eighteenth example.

A method for providing security at a self-service terminal can comprise:detecting at least one digital image; applying a facial recognitionmethod to the at least one digital image; and controlling theself-service terminal using a facial recognition criterion depending onthe result of the facial recognition method. The method having thefeatures described in this paragraph forms a nineteenth example.

The facial recognition method can comprise determining whether the atleast one digital image comprises a face of a first person. The facialrecognition method can furthermore comprise extracting biometricfeatures of the face if the at least one digital image comprises theface of the first person. The features described in this paragraph incombination with the nineteenth example form a twentieth example.

The facial recognition criterion can be dependent on whether a face wasrecognized or was not recognized. The facial recognition criterion canbe dependent on the biometric features of the face. The featuresdescribed in this paragraph in combination with the twentieth exampleform a twenty-first example.

The facial recognition criterion can comprise, if the at least onedigital image comprises the face of the first person, whether the faceis hidden. The feature described in this paragraph in combination withthe twentieth example or the twenty-first example forms a twenty-secondexample.

The face can be hidden if at least one biometric feature of thebiometric features does not satisfy a feature criterion. The featuredescribed in this paragraph in combination with the twenty-secondexample forms a twenty-third example.

Controlling the self-service terminal can comprise: controlling theself-service terminal in such a way that the self-service terminal isactivated from a standby state if the face is not hidden. The featuredescribed in this paragraph in combination with the twenty-secondexample or the twenty-third example forms a twenty-fourth example.

Controlling the self-service terminal can comprise: controlling theself-service terminal in such a way that the self-service terminalmaintains a standby state if the face is hidden. The feature describedin this paragraph in combination with one or more of the twenty-secondexample to the twenty-fourth example forms a twenty-fifth example.

The facial recognition method can determine that the at least onedigital image comprises a first face of a first person and furthermore asecond face of a second person, and controlling the self-serviceterminal can comprise: controlling the self-service terminal using afirst criterion and a second criterion depending on the result of thefacial recognition method, wherein the first criterion can be assignedto the first person and wherein the second criterion can be assigned tothe second person. The method can comprise determining first biometricfeatures assigned to the first face of the first person. The method cancomprise determining second biometric features assigned to the secondface of the second person. The features described in this paragraph incombination with one or more of the nineteenth example to thetwenty-fifth example form a twenty-sixth example.

The method can furthermore comprise providing to the first person the atleast one digital image showing the first face of the first person andthe second face of the second person. The features described in thisparagraph in combination with the twenty-sixth example form atwenty-seventh example.

The method can furthermore comprise: determining a first distancebetween the first person and the self-service terminal. The at least oneprocessor can furthermore be configured for determining a seconddistance between the second person and the self-service terminal. Themethod can furthermore comprise providing distance information to thefirst person using the first distance of the first person and the seconddistance of the second person. The features described in this paragraphin combination with the twenty-sixth example or the twenty-seventhexample form a twenty-eighth example.

The first distance of the first person can be determined using the atleast one digital image. The first distance can be determined using afirst interocular distance of the first person. The first interoculardistance can be determined using the extracted first biometric data. Thesecond distance of the second person can be determined using the atleast one digital image. The second distance can be determined using asecond interocular distance of the second person. The second interoculardistance can be determined using the extracted second biometric data.The features described in this paragraph in combination with thetwenty-eighth example form a twenty-ninth example.

The first distance of the first person and/or the second distance of thesecond person can be detected using at least one distance sensor. Thefeatures described in this paragraph in combination with thetwenty-eighth example form a thirtieth example.

Detecting at least one digital image can comprise detecting a firstdigital image and a second digital image, wherein the second digitalimage can temporally follow the first digital image. The facialrecognition method can determine that the first digital image comprisesa first face of a first person and that the second digital image doesnot comprise the first face of the first person, and controlling theself-service terminal can comprise: controlling the self-serviceterminal in such a way that the self-service terminal transitions to asecurity state. The features described in this paragraph in combinationwith one or more of the nineteenth example to the thirtieth example forma thirty-first example.

BRIEF DESCRIPTIONS OF THE DRAWINGS

In the figures:

FIG. 1 shows a self-service terminal in accordance with variousembodiments;

FIG. 2 shows a processing system for facial recognition in accordancewith various embodiments;

FIG. 3 shows a processing system in accordance with various embodiments;

FIG. 4 shows a processing system in accordance with various embodiments;

FIG. 5 shows a processing system in accordance with various embodiments;

FIG. 6 shows a method for providing security at a self service terminalin accordance with various embodiments.

DETAILED DESCRIPTION

In the following detailed description, reference is made to theaccompanying drawings, which form part of this description and show forillustration purposes specific embodiments in which the invention can beimplemented.

The term “processor” can be understood as any type of entity whichallows data or signals to be processed. The data or signals can behandled for example in accordance with at least one (i.e. one or morethan one) specific function executed by the processor. A processor cancomprise or be formed from an analog circuit, a digital circuit, amixed-signal circuit, a logic circuit, a microprocessor, a centralprocessing unit (CPU), a graphics processing unit (GPU), a digitalsignal processor (DSP), a programmable gate array (FPGA), an integratedcircuit or any combination thereof. Any other type of implementation ofthe respective functions described more thoroughly below can also beunderstood as a processor or logic circuit. It is understood that one ormore of the method steps described in detail herein can be implemented(e.g. realized) by a processor, by means of one or more specificfunctions executed by the processor. The processor can therefore beconfigured to carry out one of the methods described herein or thecomponents thereof for information processing.

Reference is made hereinafter to digital images and the processingthereof. The digital images can be any type of digital image data andcan be a digital image representation of reality (e.g. of the captureregion) at a point in time of capturing the digital image data. Theimaging of reality can be effected by means of a lens, for example,which projects light onto the surface of an imaging sensor (e.g. a Bayersensor). Capturing the image data can comprise reading the imagingsensor while the light is projected onto the surface thereof. The imagedata thus obtained can initially be in the so-called raw data format(also referred to as RAW), which comprises pixel by pixel the measuredvalues read out from the imaging sensor and/or is processed as such. Theimage data can optionally be or have been converted into a differentimage format during processing, e.g. into raster graphics (differentthan RAW as raster graphics) or vector graphics, such that their furtherprocessing takes place in this image format, or they can be convertedarbitrarily between these. The converting can optionally compriseinterpolating the measured values from the imaging sensor (e.g. by meansof demosaicings), e.g. in order to obtain complete multicolored colorinformation for each pixel of a plurality of pixels or in order torequire less memory space or computing power. The image data canoptionally be compressed (e.g. in order to require less memory space orcomputing power) or uncompressed (e.g. in order to avoid corruption).The respective image format can also define the color space according towhich the color information is specified.

The simplest case is a binary color space, in which one black-and-whitevalue is stored per pixel. In the case of a somewhat more complex colorspace (also referred to as grayscale color space), intermediate levelsbetween black and white are stored (also referred to as grayscalevalues). However, the color space can also be spanned by a plurality of(e.g. two or more) primary colors, such as red, green and blue, forexample. If the measured values are intended to comprise multicoloredcolor information, for example, a wavelength-sensitive imaging sensorcan be used. The measured values thereof can be coded in accordance witha color space, for example. The color information or the underlyingcolor space can therefore be multicolored (also referred to asphotochromatic) or else single colored (also referred to asmonochromatic). The monochromatic color information can for examplecomprise only grayscale values (then also referred to as grayscale valueinformation) or comprise black-and-white values (then also referred toas black-and-white value information) which represent the intensity ofthe captured radiation at the wavelength or in the wavelength range forwhich the monochromatic sensor is sensitive. For visual rendering of theimage data on a display device, said image data are converted into thatimage format which is predefined by the image memory of the graphicscard. For ease of understanding, the image data described herein arerepresented as such visual rendering. In general, the image data, e.g.stored in a storage medium, can be present as a file (also referred toas a digital image or image file) in the respective image format.

The image data can furthermore be assigned (e.g. as an alternative or inaddition to the color information) depth information (also referred toas 3D information). A so-called 3D camera can be used for capturing thedepth information. The measured values of the 3D camera can comprise(e.g. pixel by pixel) information concerning a topography of the imagedreality (also referred to as depth information). By way of example, thedepth information can specify the distance between a or each pixel ofthe camera of a location in space that is imaged onto the pixel. To putit another way, one distance of one object or distances of a pluralityof objects can be determined using the depth information.

The depth information can illustratively add a third spatial dimension(referred to as depth herein) to the two spatial dimensions representedby the image data. By way of example, by means of the image data, anobject can be represented as a projection onto the two-dimensionalsurface of the image sensor or the imaging sensor (also referred to as2D image data). In addition to this the depth information spans thethird spatial dimension. By way of example, the depth information cancomprise values (also referred to as depth values) which are assigned tothe image data segment wise (i.e. for each segment of the image data)and which indicate the depth thereof. By way of example, the depthinformation can comprise depth values which are assigned to the imagedata pixelwise (i.e. for each pixel of the image data) and whichindicate the depth.

In accordance with various embodiments, depth information is obtained bymeans of three-dimensional (3D) image capture. The depth information canbe used for example to recognize whether an object is situated outsideor behind (as viewed from the imaging device) a reference plane. Thespatial distance from the reference plane at which an object is situatedcan thus be distinguished. By way of example, it is possible to obtainthe depth information through the entire capture region, such thatillustratively from the side it is possible to recognize the spatialposition of one or more than one object relative to the reference plane.The reference plane can be oriented for example along the direction ofgravity if one or more than one perspective of the image capture deviceruns transversely with respect to the direction of gravity. In moregeneral terms, the reference plane can run along a direction that istransverse with respect to the or each perspective of the imagingdevice. By way of example, the image data can also be captured obliquelyfrom above.

In accordance with various embodiments, the image capture device canprovide image data of the capture region from a plurality of opticalperspectives (e.g. provided by means of a plurality of lenses) whichrepresent depth information of the capture region, (e.g.stereoscopically). In order to determine the depth information, theimage data captured from different perspectives (e.g. by means of aplurality of lenses) can be superposed on one another, e.g. takingaccount of a relative spatial pose (position and/or orientation) of thelenses with respect to one another. A camera can comprise an (optical)image capture sensor and at least one lens (also referred to as lensarrangement) assigned to the imaging sensor. The lens arrangement of aplenoptic camera can also comprise a grid of a plurality of microlenses. By way of example, the imaging device can comprise an RGBimaging sensor and/or a 3D imaging sensor.

An imaging sensor (also referred to as an image sensor) is of the typeof the optical sensor and can comprise one or more photoelectricallyactive regions (can also be referred to as pixel) which generate and/ormodify an electrical signal e.g. in response to electromagneticradiation (e.g. light, e.g. visible light). The imaging sensor cancomprise or be formed from a CCD sensor (charge-coupled device sensor)and/or an active pixel sensor (can also be referred to as CMOS sensor),for example. Optionally, an imaging sensor can be configured in awavelength-sensitive fashion (e.g. for capturing color information),e.g. by means of a plurality of color filters (e.g. in grid form), andcan thus distinguish between different wavelengths.

The depth information can be quantified, e.g. with indication of thedepth as value (also referred to as depth value), can be coded or canitself be provided by means of image data, e.g. by assignment of imagedata captured simultaneously from a different perspective (e.g.separately from one another or superposed on one another). The pluralityof simultaneously captured perspectives can be superposed on oneanother, for example, in order to quantify the depth information. Eachdepth value of the depth information can then correspond for example toa deviation between the plurality of simultaneously capturedperspectives.

Various embodiments relate to a self-service terminal and to a methodfor providing security at a self-service terminal. It may be necessaryto prevent harmful behavior, such as, for example, fraud, theft, etc.,at a self-service terminal. Illustratively, a self-service terminal anda method are provided which are able to provide security for a userduring the use of a self-service terminal and also to prevent harmfulbehavior at a self-service terminal.

FIG. 1 illustrates a self-service terminal 100 in accordance withvarious embodiments. The self-service terminal 100 can be an automatedteller machine (a cash machine), a self-service checkout or aself-service kiosk. The self-service terminal 100 can comprise animaging device 102. The imaging device 102 can be configured to provideat least one digital image 104, for example to provide a plurality ofdigital images 106. The imaging device 102 can comprise one or moresensors. The one or more sensors can be configured to provide digitaldata. The imaging device 102 can be configured to provide the at leastone digital image 104 or the plurality of digital images 106 using thedigital data provided. In accordance with various embodiments, thedigital data comprise digital image data. The one or more sensors can beimaging sensors, such as, for example, a camera sensor or a videosensor. The sensors of the plurality of sensors can comprise the sametype or different types of sensors. The imaging device 102 can beconfigured to detect the digital data or the at least one digital image104 in reaction to an event. The self-service terminal can comprise oneor more motion sensors, for example, and the triggering event can be amovement detected by means of the one or more motion sensors.

The self-service terminal 100 can comprise a user interface configuredto enable a person, such as a user, for example, to operate (for exampleby means of an input device of the user interface) the self-serviceterminal 100. The event that triggers the detection of the at least onedigital image 104 can be an event triggered by the user, such as, forexample, entry of a PIN at an automated teller machine, selection at aself-service kiosk, selecting or inputting a product at a self-servicecheckout, etc.

The self-service terminal 100 can furthermore comprise a storage device108. The storage device 108 can comprise at least one memory. The memorycan be used for example during the processing carried out by aprocessor. A memory used in the embodiments can be a volatile memory,for example a DRAM (dynamic random access memory), or a nonvolatilememory, for example a PROM (programmable read only memory), an EPROM(erasable PROM), an EEPROM (electrically erasable PROM) or a flashmemory, such as, for example, a floating gate memory device, a chargetrapping memory device, an MRAM (magnetoresistive random access memory)or a PCRAM (phase change random access memory). The storage device 108can be configured to store digital images, such as, for example, the atleast one digital image 104 or the plurality of digital images 106.

The self-service terminal 100 can furthermore comprise at least oneprocessor 110. The at least one processor 110 can be, as describedabove, any type of circuit, i.e. any type of logic-implementing entity.The processor 110 can be configured to process the at least one digitalimage 104 or the plurality of digital images 106.

FIG. 2 illustrates a processing system for facial recognition 200 inaccordance with various embodiments. The processing system for facialrecognition 200 can comprise the storage device 108. The storage device108 can be configured to store 104, for example to store in volatilefashion, for example to store in nonvolatile fashion, digital images,such as, for example, the digital image 104 or the plurality of digitalimages 106. The processing system for facial recognition 200 canfurthermore comprise the at least one processor 110. The storage device108 can be configured to provide the processor 110 with the at least onedigital image 104, and the processor 110 can be configured to processthe at least one digital image 104.

The at least one digital image 104 can comprise a face 202 of a person.The processor 110 can be configured to apply a facial recognition methodto the at least one digital image 104. The facial recognition method cancomprise: determining 204 whether the at least one digital image 104comprises a face 202 of a person. Determining 204 whether the at leastone digital image 104 comprises a face 202 of a person can compriseusing a facial recognition algorithm. The facial recognition algorithmcan be a neural network, for example. The facial recognition method canbe a biometric facial recognition method. The facial recognition methodcan be a two-dimensional facial recognition method or athree-dimensional facial recognition method. The processor 110 canfurthermore be configured, if the at least one digital image 104comprises the face 202 of the person (“Yes” in FIG. 2 ), to determine orto extract biometric features 206 of the face 202. In accordance withvarious embodiments, the facial recognition method is a biometric facialrecognition method that provides the biometric features 206 of therecognized face 202. The storage device 108 can be configured to storethe biometric features 206 of the face 202.

The processor 110 can furthermore be configured, if the at least onedigital image 104 does not comprise a face of a person (“No” in FIG. 2), to provide first information 208 that no face was recognized, and thestorage device 108 can be configured to store the first information 208that no face was recognized.

FIG. 3 illustrates a processing system 300 in accordance with variousembodiments. The processing system 300 can comprise the storage device108. The storage device 108 can be configured to store the biometricfeature 206 of the face 202 of the person. The processing system 300 canfurthermore comprise the at least one processor 110. The at least oneprocessor 110 can be configured to process the biometric features 206 ofthe face 202. The processor 110 can be configured to determine 302whether a feature criterion of the biometric features 206 is satisfied.The feature criterion can comprise for example a required number ofrecognized biometric features and/or can comprise the presence ofbiometric features (for example the presence of biometric features ofthe mouth region of the face). The processor 110 can be configured, ifthe feature criterion of the biometric features 206 is not satisfied(“No” in FIG. 3 ), to determine second information 304 that the face 202of the person is hidden. The face 202 can be hidden by a mask, forexample. That is to say that the person assigned to the face 202 can bedisguised. The processor 110 can be configured, if the feature criterionof the biometric features 206 is satisfied (“Yes” in FIG. 3 ), todetermine third information 306 that the face 202 of the person is nothidden.

A facial recognition criterion can comprise the first information 208that no face was recognized, the second information 304 that the face202 is hidden, or the third information 306 that the face 202 is nothidden. The processor 110 can be configured to control the self-serviceterminal 100 using the facial recognition criterion depending on theresult of the facial recognition method. That is to say that theprocessor 110 can be configured to control the self-service terminalusing the first information 208 that no face was recognized, using thesecond information 304 that the face 202 is hidden, or using the thirdinformation 306 that the face 202 is not hidden. The self-serviceterminal 100 can be in a standby state (an operating state ofreadiness), for example. The processor 110 can be configured to maintainthe standby state 308 using the first information 208 that no face wasrecognized. To put it another way, the processor 110 can be configuredto maintain the standby state 308 if no face was recognized. Theprocessor 110 can be configured to maintain the standby state 308 usingthe second information 304 that the face 202 is hidden. To put itanother way, the processor 110 can be configured to maintain the standbystate 308 if the face 202 is hidden. In accordance with variousembodiments, the self-service terminal 100 furthermore comprises a userinterface. The user interface can comprise a display device, which canbe configured to provide the person (for example the user of theself-service terminal 100), i.e. the person to whom the face 202 isassigned, with information regarding the facial recognition (i.e. theresult of the facial recognition method). The display device can beconfigured to provide the person with the second information 304 thatthe face 202 is hidden. By way of example, the display device cancomprise a screen and can display the information regarding the facialrecognition on the screen, for example in the form of text. Thedisplayed information can comprise for example an instruction indicatingthat the person ought to expose, i.e. uncover or show, the face 202.

The processor 110 can be configured to control the self-service terminal100 using the third information 306 that the face 202 is not hidden. Theprocessor 110 can be configured for activating 310 the self-serviceterminal 100, for example for activating 310 from the standby state 308,if the face 202 is not hidden (third information 306).

FIG. 4 illustrates a processing system 400 in accordance with variousembodiments. The processing system 400 can comprise facial recognition402. The facial recognition 402 can substantially correspond to theprocessing system for facial recognition 200, wherein the facialrecognition 402 can process at least one digital image 404, which cancomprise more than one face. The at least one digital image 404 cancomprise a first face 406 of a first person and a second face 408 of asecond person, and the facial recognition 402 can be configured todetermine or to recognize the first face 406 of the first person and thesecond face 408 of the second person in the at least one digital image404. The facial recognition 402 can furthermore be configured todetermine or to extract the biometric features of the first face 406and/or the biometric features of the second face 408. The at least oneprocessor 110 can be configured to determine whether a first criterion410 is satisfied. The first criterion 410 can be assigned to the firstface 406 of the first person. The processor 110 can be configured todetermine whether a second criterion 412 is satisfied. The secondcriterion 412 can be assigned to the second face 408 of the secondperson. The first criterion 410 and/or the second criterion 412 can eachbe a facial recognition criterion, wherein the facial recognitioncriterion, as described above, can comprise information of whether aface is hidden, or information of whether a face is not hidden. Theprocessor 110 can be configured to determine a first distance betweenthe first person and the self-service terminal 100 and can furthermorebe configured to determine a second distance between the second personand the self-service terminal 100. The processor 110 can be configuredto determine the first distance and/or the second distance using the atleast one digital image 404. The processor 110 can be configured todetermine a first interocular distance using the biometric features ofthe first face 406 and can furthermore be configured to determine thefirst distance of the first person using the first interocular distancedetermined. The processor 110 can be configured to determine a secondinterocular distance using the biometric features of the second face 408and can furthermore be configured to determine the second distance ofthe second person using the second interocular distance determined.

According to various embodiments, the self-service terminal 100furthermore comprises at least one distance sensor, for example aplurality of distance sensors. The at least one distance sensor can beany type of sensor that is able to provide data which can be used todetermine a distance. The at least one distance sensor can be a stereocamera, for example. The at least one distance sensor can be a remotelocating sensor, such as, for example, a radar sensor, a LIDAR sensor oran ultrasonic sensor. The distance sensors of the plurality of distancesensors can comprise the same type or different types of distancesensors.

The at least one distance sensor can be configured to provide distancedata, and the processor 110 can be configured to determine a distance ofa person using the distance data provided. That is to say that theprocessor 110 can be configured to determine the first distance of thefirst person and the second distance of the second person using thedistance data provided. In accordance with various embodiments, theprocessor 110 is configured to determine the first distance of the firstperson using the distance data provided and using the first interoculardistance determined, and to determine the second distance of the secondperson using the distance data provided and using the second interoculardistance determined.

The first criterion 410 and/or the second criterion 412 can be adistance criterion in each case. The processor 110 can be configured tocontrol the self-service terminal 100 using the first criterion 410 andthe second criterion 412.

In accordance with various embodiments, the first criterion 410comprises a first facial recognition criterion and a first distancecriterion and the second criterion 412 comprises a second facialrecognition criterion and a second distance criterion and the processor110 can control the self-service terminal 100 using the first criterion410 and the second criterion 412.

The at least one processor 110 can be configured to determine anindication 414 using the first criterion 410 and the second criterion412, and optionally to output said indication. In accordance withvarious embodiments, the self-service terminal 100 furthermore comprisesa display device. The display device can be configured to provide a userof the self-service terminal 100, for example the first person, withinformation. The display device can comprise a screen, for example, andthe display device can be configured to provide, i.e. display,information on the screen. The processor 110 can be configured toprovide the display device with the indication 414 and the displaydevice can be configured to provide information using the indication414, for example to display said information on the screen. The imagingdevice 102 can comprise a video camera for providing a video stream andthe display device can be configured to display the provided videostream on the screen.

By way of example, the determined first distance of the first person andthe determined second distance of the second person can be greater thana first distance criterion and a second distance criterion,respectively, and the processor 110 can be configured to determine thatneither the first person nor the second person is using the self-serviceterminal 100.

By way of example, the determined first distance of the first person canbe less than a first distance criterion and the determined seconddistance of the second person can be less than a second distancecriterion and it can furthermore be the case that the first facialrecognition criterion and the second facial recognition criterion arenot satisfied, that is to say that the processor 110 determines that thefirst person and the second person are disguised or masked. Theprocessor 110 can be configured to determine that a security violationmight be present, and can be configured to communicate information to asecurity service and/or the police.

By way of example, the determined first distance of the first person canbe less than a first distance criterion and the determined seconddistance of the second person can be less than a second distancecriterion, wherein the first distance of the first person is less thanthe second distance of the second person. In this case, the processor110 can determine, for example, that the first person is a user of theself-service terminal 100 and that the second person is not a user ofthe self-service terminal 100. The processor 110 can determine, forexample, that the second person is not complying with a personal spacedistance. Furthermore, the first facial recognition criterion and thesecond facial recognition criterion can be satisfied, that is to saythat the processor 110 determines that the first person and the secondperson are not disguised. The processor 110 can be configured todetermine that a security violation might be present. The self-serviceterminal 100 can be an automated teller machine and the securityviolation may be, for example, that the second person, who was notdetermined as a user of the self-service terminal 100, is attempting tocovertly observe the PIN (personal identification number) of the firstperson, who was determined as a user of the self-service terminal 100.The processor 110 can be configured to communicate the indication 414that a security violation might be present to the display device, andthe display device can be configured to provide the first person, i.e.the user of the self-service terminal 100, with information. The displaydevice can be configured to provide the first person with the at leastone digital image 404 comprising the face 406 of the first person andthe face 408 of the second person, for example to display it on thescreen. The processor 110 can furthermore be configured to provide thedisplay device with the first distance of the first person and thesecond distance of the second person. The display device can beconfigured to mark the first face 406 of the first person displayed onthe screen as a user, for example to represent it with a first coloredframe, such as a green frame, for example, and can furthermore beconfigured to mark the second face 408 of the second person displayed onthe screen as a potential threat, for example to represent it with asecond colored frame, such as a blue, yellow or red frame, for example,wherein a respective marking, such as, for example, a blue frame or ared frame, can be selected depending on the determined second distanceof the second person. The display device can furthermore be configuredto provide the first person with additional information, for example inthe form of text, as sound, etc. In accordance with various embodiments,the self-service terminal 100 furthermore comprises a user interface,wherein the user interface can comprise the display device and whereinthe user interface can furthermore comprise an input device. The inputdevice can be configured to enable the user of the self-service terminal100 to interact with the self-service terminal 100. The input device canbe for example a keypad, for example a keyboard. The display device andthe input device can be integrated as a touch-sensitive screen(touchscreen). The information provided by means of the display devicecan enable the first person to deny the potential threat by means of theinput device. That is to say that the first person can indicate by meansof the user interface that the second person is not a threat (the secondperson may be, for example, a friend, a partner or a family member). Theprocessor 110 can be configured to block a use of the self-serviceterminal 100 until the first person, i.e. the user, has denied thepotential threat.

FIG. 5 illustrates a processing system 500 in accordance with variousembodiments. The self-service terminal 100 can comprise the processingsystem 500. The processing system 500 can comprise the imaging device102. The imaging device 102 can be configured to provide a first digitalimage 502 and a second digital image 504. The second digital image 504,from a temporal standpoint, can follow the first digital image 502. Toput it another way, the second digital image 504 can be detectedtemporally after the first digital image 502. The first digital image502 and the second digital image 504 can be detected during theoperation of the self-service terminal 100. To put it another way, thefirst digital image 502 and the second digital image 504 can be detectedin a time window given by a start process of the self-service terminal100 and an end process of the self-service terminal 100. That is to saythat the time window can begin with a start process, such as, forexample, selection at a self-service kiosk or entry of a PIN at anautomated teller machine, and can end with an end process, such as, forexample, withdrawal of the money from a dispensing tray of the automatedteller machine.

The processing system 500 can furthermore comprise the storage device108 for storing the first digital image 502 and the second digital image504. The processing system 500 can comprise the at least one processor110. The processor 110 can be configured to process the first digitalimage 502 and the second digital image 504. The processor 110 can beconfigured to carry out the facial recognition 402. That is to say thatthe processor 110 can be configured to determine whether the firstdigital image 502 and/or the second digital image 504 comprise(s) a faceof a person. The processor 110 can be configured, if the first digitalimage 502 comprises a face of a person, to determine or to extract firstbiometric features of the face, and can be configured, if the seconddigital image 504 comprises a face of a person, to determine or toextract second biometric features of the face. The processor 110 canfurthermore be configured, as described with reference to FIG. 4 , todetermine a distance of a person. That is to say that the processor 110can be configured to determine the distance of the person using theinterocular distance of the person (for example determined using thebiometric data) and/or the self-service terminal 100 can comprise atleast one distance sensor for providing distance data and the processor110 can be configured to determine the distance of the person using thedistance data.

By way of example, the processor 110 can determine that the firstdigital image 502 comprises a first face 506 of a first person. Theprocessor 110 can furthermore determine a first distance of the firstperson. The processor 110 can be configured to determine the firstperson as a user of the self-service terminal using the determined firstface 506 of the first person and optionally using the first distance ofthe first person. The processor 110 can determine, for example, that thesecond digital image 504 does not comprise a face of a person and theprocessor 110 can be configured to control the self-service terminal 100in such a way that the self-service terminal 100 transitions to asecurity state 510. The processor 110 can be configured to control theself-service terminal in such a way that the self-service terminal 100transitions to a security state 510 after a predefined time interval(for example after 5 seconds, for example after 10 seconds, for exampleafter more than 10 seconds) after the detection of the second digitalimage 504 that does not comprise a face of a person. The security state510 can also be the standby state if the self-service terminal 100 is ina non-critical state (for example is in a state in which a second personcould not cause damage) at the time of the detection of the seconddigital image 504.

The self-service terminal 100 can be an automated teller machine and thesecond digital image 504 can be detected at a time at which the moneydispensing tray is open and has money; the security state 510 cancomprise for example the money dispensing tray being closed. Theself-service terminal can comprise the user interface and the processor110 can furthermore be configured to communicate information regardingthe security state 510 to the display device of the user interface. Thedisplay device can be configured to provide the information regardingthe security state 510, for example to display it on a screen, forexample to output an acoustic indication, such as an acoustic signal,for example. To put it another way, the display device can be configuredto make a user aware of the security state 510, i.e. for example theopen money dispensing tray having the money, by means of displaying oroutputting the information on a screen and/or by means of outputting anacoustic indication.

By way of example, the processor 110 can determine that the firstdigital image 502 comprises a first face 506 of a first person. Theprocessor 110 can furthermore determine a first distance of the firstperson. The processor 110 can be configured to determine the firstperson as a user of the self-service terminal using the determined firstface 506 of the first person and optionally using the first distance ofthe first person. The processor 110 can be configured to determine firstbiometric features of the first face 506 of the first person or toextract them from the first digital image 502. The processor 110 candetermine, for example, that the second digital image 504 comprises asecond face 508 of a second person. The processor 110 can be configuredto determine second biometric features of the second face 508 of thesecond person or to extract them from the second digital image 504. Theprocessor 110 can determine, for example, that the second face 508 isdifferent than the first face 506. To put it another way, the firstbiometric features determined can be different than the second biometricfeatures determined. The processor 110 can be configured to control theself-service terminal 100 in such a way that the self-service terminal100 transitions to the security state 510 if said processor determinesthat the first biometric features and the second biometric features aredifferent. That is to say that the second digital image 504 comprises adifferent person than the first digital image 502. The self-serviceterminal 100 can be an automated teller machine and the second digitalimage 504 can be detected at a time at which the money dispensing trayis open and has money; the security state 510 can comprise for examplethe money dispensing tray being closed. The self-service terminal 100can be an automated teller machine and the second digital image 504 canbe detected at a time at which the PIN of the user has already beenentered; the security state 510 can comprise for example theself-service terminal 100, i.e. the automated teller machine, beingblocked so that no money can be withdrawn. For example, renewed entry ofa PIN can be requested in this case. The self-service terminal 100 cancomprise the user interface and the processor 110 can furthermore beconfigured to communicate information regarding the security state 510to the display device of the user interface. The display device can beconfigured to provide the information regarding the security state 510,for example to display it on a screen.

In accordance with various embodiments, the at least one processor 110of the self-service terminal 100 can be configured, depending on theresult of the facial recognition method applied to the at least onedigital image 104 or the digital image 404, to determine furtherabnormal behavior, such as, for example, the presence of a large numberof persons, the presence of one or more persons without use of theself-service terminal 100, persons moving quickly (i.e. more quicklythan a predefined speed criterion), etc., and to control theself-service terminal 100 in reaction to the abnormal behaviordetermined (for example to transition to a security state, for exampleto inform a security service, etc.).

In one or more (for example each) of the processing system 300, theprocessing system 400 and/or the processing system 500, the at least oneprocessor 110 can be configured to erase at least one digital imagestored in the storage device 108 (for example each digital image of theplurality of digital images stored in the storage device 108) and/or thebiometric features determined using a digital image (for example thebiometric features 206 of the face 202 determined using the at least onedigital image 104) after a termination criterion has been satisfied. Toput it another way, the processor 110 can be configured to communicate acommand to the storage device 108, and the storage device 108 can beconfigured to erase the respective digital image and/or the respectivebiometric features in reaction to the command. The termination criterioncan define an end process of the operation of the self-service terminal100. By way of example, the self-service terminal 100 can be anautomated teller machine and the termination criterion can be thewithdrawal of the money from a dispensing tray. By way of example, theself-service terminal 100 can be a self-service checkout and thetermination criterion can be the successful payment process or thepacking of the product(s) or goods.

FIG. 6 illustrates a method 600 for providing security at a self-serviceterminal 100 in accordance with various embodiments. The method 600 cancomprise detecting at least one digital image 104 (in 602). The method600 can furthermore comprise applying a facial recognition method to theat least one digital image 104 (in 604). The facial recognition methodcan comprise: determining whether the at least one digital image 104comprises a face of a person. The facial recognition method canfurthermore comprise: if the at least one digital image 104 shows theface 202 of the person, extracting biometric features 206 of the face202. The method 600 can furthermore comprise: controlling theself-service terminal 100 using a facial recognition criterion dependingon the result of the facial recognition method (in 606). The facialrecognition criterion can comprise whether a face of a person wasrecognized or whether no face was recognized. The facial recognitioncriterion can be dependent on the extracted biometric features 206 ofthe face 202. The facial recognition criterion can comprise for examplewhether the extracted biometric features 206 satisfy or do not satisfy afeature criterion 302, wherein the face 202 can be hidden if the featurecriterion 302 is not satisfied, and wherein it can be the case that theface 202 is not hidden if the feature criterion is satisfied. Theself-service terminal 100 can be controlled in such a way that theself-service terminal 100 is activated from a standby state if the face202 is not hidden. The self-service terminal 100 can be controlled insuch a way that the self-service terminal 100 maintains a standby stateif the face 202 is hidden.

The facial recognition method can determine that the digital image 404comprises a first face 406 of a first person and a second face 408 of asecond person, and the method 600 can comprise controlling theself-service terminal 100 using a first criterion 410 and a secondcriterion 412, wherein the first criterion 410 can be assigned to thefirst face 406 of the first person and the second criterion 412 can beassigned to the second face 408 of the second person. Controlling theself-service terminal 100 can comprise providing the at least onedigital image 104, 404 to the first person and/or the second person, forexample displaying the at least one digital image 104, 404 on a screenof the self-service terminal 100. The method 600 can comprise detectinga first digital image 502 and a second digital image 504 (optionally in602). The second digital image 504, from a temporal standpoint, canfollow the first digital image 502 (i.e. can be detected at a latertime). The method 600 can comprise applying the facial recognitionmethod to the first digital image 502 and the second digital image 504(optionally in 604). The facial recognition method can determine thatthe first digital image 502 comprises a first face 506 of a first personand that the second digital image 504 does not comprise the first face506. The method 600 can comprise controlling the self-service terminal100 depending on the result of the facial recognition method (optionallyin 606). The method 600 can comprise: controlling the self-serviceterminal 100 in such a way that the self-service terminal 100transitions to a security state if the first digital image 502 comprisesthe first face 506 of the first person and if the second digital image504 does not comprise the first face 506.

1. A self-service terminal comprising: an imaging device configured forproviding at least one digital image; at least one processor configuredfor: applying a facial recognition program to the at least one digitalimage; and controlling the self-service terminal using a facialrecognition criterion depending on the result of the facial recognitionprogram; wherein the at least one digital image is further defined as afirst digital image and a second digital image temporally following thefirst digital image; wherein the at least one processor, while executingthe facial recognition program, is further configured to determine thatthe first digital image includes a first face of a first person; whereinthe at least one processor, while executing the facial recognitionprogram, is further configured to determine that the second digitalimage does not include the first face of the first person; and whereinthe at least one processor further configured is to transition theself-service terminal to a security state in response to determiningthat the first digital image includes the first face of the first personand that the second digital image does not include the first face of thefirst person.
 2. The self-service terminal as claimed in claim 1,wherein the at least one processor, while executing the facialrecognition program, when the first digital image includes the firstface of the first person, is further configured to: extract biometricfeatures of the first face.
 3. The self-service terminal as claimed inclaim 2, wherein, the at least one processor is further configured tocompare of the biometric features against a feature criterion.
 4. Theself-service terminal as claimed in claim 3, wherein the at least oneprocessor is further configured to: control the self-service terminalsuch that the self-service terminal is activated from a standby state ifthe second digital image includes the first face.
 5. The self-serviceterminal as claimed in claim 4 further comprising: a display device,wherein the at least one processor is further configured to control theself-service terminal such that: the display device displays informationthat the first face is not in the second digital image.
 6. Theself-service terminal as claimed in claim 1, wherein the at least oneprocessor, while executing the facial recognition program, is furtherconfigured to: determine that the at least one digital image comprisesthe first face of the first person and furthermore a second face of asecond person; and control the self-service terminal using a firstcriterion and a second criterion determined by while executing thefacial recognition program, wherein the first criterion is assigned tothe first person and wherein the second criterion is assigned to thesecond person.
 7. The self-service terminal as claimed in claim 6,furthermore comprising: a display device, configured to display the atleast one digital image showing the first face of the first person andthe second face of the second person, and wherein the at least oneprocessor is furthermore configured to: determine a first distancebetween the first person and the self-service terminal; determine asecond distance between the second person and the self-service terminal;and wherein the display device is furthermore configured to display thefirst distance of the first person and the second distance of the secondperson.
 8. The self-service terminal as claimed in claim 7, wherein theat least one processor is further configured to: determine, from the atleast one digital image, an interocular distance of at least one of thefirst person and the second person.
 9. The self-service terminal asclaimed in claim 7, furthermore comprising: at least one distance sensorconfigured to detect a distance of a person, wherein the at least oneprocessor determines at least one of the first distance and the seconddistance using the distance of the person detected by the at least onedistance sensor.
 10. (canceled)
 11. The self-service terminal as claimedin claim 1, furthermore comprising: a storage device configured to storethe at least one digital image and to erase the at least one digitalimage after a termination criterion has been satisfied.
 12. A method ofoperating a self-service terminal comprising: detecting a first digitalimage with an imaging device; applying, with at least one processor, afacial recognition program to the the first digital image; locating,with the at least one processor while executing the facial recognitionprogram, a first face of a first person in the first digital image;extracting, with the at least one processor, one or more first biometricfeatures of the first face from the first digital image; storing, in astorage device of the self-service terminal, the one or more firstbiometric features of the first face; determining, with the at least oneprocessor, whether a number of the one more first biometric features ofthe first face is at least equal to a first facial recognitioncriterion; and controlling, with the at least one processor, theself-service terminal based on the result of said determining whetherthe number of the one more first biometric features of the first face isat least equal to a first facial recognition criterion. 13.-15.(canceled)
 16. The method of claim 12 wherein said controlling isfurther defined as: controlling, with the at least one processor, theself-service terminal to activate from a standby state when the numberof the one more first biometric features of the first face is at leastequal to a first facial recognition criterion.
 17. The method of claim12 wherein said controlling is further defined as: controlling, with theat least one processor, the self-service terminal to maintain a standbystate when the number of the one more first biometric features of thefirst face is not at least equal to a first facial recognitioncriterion.
 18. The method of claim 12 further comprising: detecting asecond digital image with the imaging device temporally after saiddetecting the first digital image; applying, with the at least oneprocessor, the facial recognition program to the second digital image;determining, with the at least one processor while executing the facialrecognition program, that the first face is not in the second digitalimage; and controlling, with the at least one processor, theself-service terminal to block the dispensing of currency in response tosaid determining that the first face is not in the second digital image.19. The method of claim 12 further comprising: receiving, with theself-service terminal, a personal identification number from a user;detecting a second digital image with the imaging device temporallyafter said detecting the first digital image after said receiving;applying, with the at least one processor, the facial recognitionprogram to the second digital image; locating, with the at least oneprocessor while executing the facial recognition program, a second faceof a second person in the second digital image; determining, with the atleast one processor, that the first face and the second face aredifferent from one another; controlling, with the at least oneprocessor, the self-service terminal to block the dispensing of currencyin response to said determining that the first face and the second faceare different from one another; displaying, with a display device of theself-service terminal, information that the PIN must be received again,in response to said determining that the first face and the second faceare different from one another; receiving, with the self-serviceterminal, the PIN from the user after said displaying; and controlling,with the at least one processor, the self-service terminal to resumedispensing of currency in response to said receiving the PIN from theuser after said displaying.
 20. The method of claim 12 furthercomprising: detecting a second digital image with the imaging devicetemporally after said detecting the first digital image; applying, withthe at least one processor, the facial recognition program to the seconddigital image; locating, with the at least one processor while executingthe facial recognition program, a second face of a second person in thesecond digital image; extracting, with the at least one processor, oneor more second biometric features of the second face from the seconddigital image; determining, with the at least one processor, that anumber of the one more first biometric features of the first face is atleast equal to a first facial recognition criterion; determining, withthe at least one processor, that a number of the one more secondbiometric features of the second face is at least equal to a secondfacial recognition criterion; determining, with the at least oneprocessor, a first distance between the first person and theself-service terminal; determining, with the at least one processor,that the first distance is less than a first facial recognitioncriterion; determining, with the at least one processor, a seconddistance between the second person and the self-service terminal;determining, with the at least one processor, that the second distanceis less than a second facial recognition criterion; determining, withthe at least one processor, that the first distance is less than thesecond distance; and controlling, with the at least one processor, theself-service terminal to block the dispensing of currency in response tosaid determining that the first distance is less than the seconddistance.
 21. The method of claim 20 further comprising: determining,with the at least one processor, a first interocular distance of thefirst person using the extracted one or more first biometric features ofthe first face from the first digital image; and wherein saiddetermining the first distance is further defined as determining, withthe at least one processor, the first distance between the first personand the self-service terminal using the first interocular distance.